Two users are getting buried under spam emails—what actually helps stop an ongoing mail bomb?

Treat the mail flood as possible cover for another attack, not just an annoying spam problem. Search the affected mailboxes across the entire period for purchase confirmations, password resets, account changes, invoices, wire instructions, and other legitimate notifications that may be buried. Review sign-in activity, mailbox rules, payment changes, and any unusual account access, then reset passwords and verify MFA if there is any suspicion of compromise. Also warn the users not to let anyone claiming to be IT take remote access or troubleshoot through an unsolicited call.

As a temporary workaround, changing the users’ primary email addresses can sometimes stop the flood, but it is disruptive and may not work if the attacker continues targeting the old addresses. Another option is to keep accepting mail into a separate mailbox and filter or review it there while the main addresses are protected. If your provider supports it, a tarpitting or throttling service can also keep the volume from overwhelming the users without relying on sender blocks.

A dedicated email-security policy can reduce the visible flood. Features such as registration-bomb or email-bomb detection, language or geographic filtering, and rules targeting common unsubscribe or bulk-mail patterns can help, especially when applied only to the affected users. Keep in mind that blocking domains and IPs alone usually fails because the messages come from legitimate services and constantly changing senders. Put the messages into quarantine or a holding mailbox rather than deleting everything, so legitimate mail can still be recovered.

Restrict external communication in Teams while this is happening. Disable external access where possible, or use an allowlist for trusted organizations, and make sure users know that real IT staff will not unexpectedly ask for credentials or remote access. The follow-up call is often the more dangerous part of the campaign.